Colorado enacts revised AI law | United States | Global law firm – Norton Rose Fulbright

Authors:
United States |  Publication |  May 2026
Colorado’s first artificial intelligence (AI) governance law (SB24-205, the “AI Act”) has been the center of attention recently. As we previously discussed, in early April X.AI sued to enjoin enforcement of the AI Act. The federal government quickly moved to intervene (the first instance of a federal intervention into a challenge to a state-level AI governance law), and then the Colorado Attorney General agreed to suspend enforcement of the AI Act pending:
One of those steps has since occurred: the Colorado General Assembly has now amended the AI Act, and the Governor of Colorado signed the amended law on May 14, 2026. It will go into effect on January 1, 2027.
The amended law, Senate Bill 26-189 (SB26-189, referred herein as the Revised CO AI Act), repealed and replaced the AI Act. The adoption of the Revised CO AI Act changes how the state intends to govern artificial intelligence going forward, including by departing from the AI Act’s algorithmic discrimination and duty of care framework. Instead, under the Revised CO AI Act, the state will regulate the use of automated decision-making technology (ADMT) in “consequential decisions,” and remove the terminology of “high-risk artificial intelligence systems” initially used when the AI Act was introduced in May 2024.
This article examines the content of the Revised CO AI Act and what it signals for the future of state-level AI regulation across the country.
Under the Revised CO AI Act, Colorado removed certain standards, revised certain defined terms carried over from the initial Colorado AI Act and introduced new defined terms that were previously absent. Notably, the Revised CO AI Act does not include the expression “artificial intelligence” and instead uses the term “automated decision-making technology,” defined as a technology that processes personal data to generate recommendations, rankings or scores that are used to make decisions concerning an individual.¹ Whereas the AI Act previously imposed requirements in connection with “high-risk artificial intelligence systems,” the Revised CO AI Act creates obligations for developers and deployers of a “covered ADMT.” The expression is defined as an ADMT “used to materially influence a consequential decision.^“2 Under the Revised CO AI Act, the definition of a “consequential decision” remains substantially similar to the one initially included in the original AI Act, encompassing decisions that relate to an individual’s access to education, employment, housing, financial services, insurance, health care and government services.
The Revised CO AI Act does not carry over all standards from the AI Act, largely centering on the AI Act’s algorithmic discrimination and risk management requirements. This includes removing the duty of care to mitigate algorithmic discrimination risks, requirements regarding algorithmic discrimination, and requirements to perform annual impact assessments and maintain a risk management program.
The Revised CO AI Act imposes separate requirements for developers and deployers of covered ADMTs. In the context of Executive Order 14365’s effort to dissuade “onerous” state AI regulation, Colorado characterized the Revised CO AI Act as protecting consumers “while not being onerous on developers or the businesses who use AI technology.” Under the law, a developer of a covered ADMT is required to provide deployers with notice of any material updates or modifications, as well as documentation describing:
Under the Revised CO AI Act, a consumer has a right to request a response from a deployer if the consumer experiences an adverse outcome resulting from a consequential decision that involved a covered ADMT that materially influenced the consequential decision. In those circumstances, a consumer has the right to:
The law’s introduction of a “meaningful human review” imposes a new oversight obligation on deployers following an adverse outcome. Under this requirement, deployers are required to designate an individual who will receive training to conduct such review and who has the authority to potentially override a consequential decision made by the covered ADMT.
The “meaningful human review” is of particular interest, as it is one of the newly created consumer rights under the Revised CO AI Act. In circumstances where a Colorado resident experiences an adverse outcome involving a covered ADMT, a meaningful human review may be requested of the deployer.
Consumers are able to make such requests for “meaningful human reviews” in part based on the information made available to them by deployers in certain disclosures mandated by the Revised CO AI Act. Deployers are required to provide a “clear and conspicuous” notice to consumers that a covered ADMT is or will be used in a consequential decision. Deployers can satisfy this obligation by maintaining a “prominent public notice that is reasonably accessible at points of consumer interaction.”
Finally, the Revised CO AI Act requires that deployers provide consumers with an easily understandable description of a consequential decision resulting in an adverse outcome when a covered ADMT was involved in the process. Such disclosure must be provided to consumers within 30 days and may vary in its specific content depending on the industry in which the consequential decision is made. The specific requirements of this disclosure will be determined through rules to be adopted by the Colorado Attorney General on or before January 1, 2027.
Much like its predecessor, the Revised CO AI Act does not provide a private right of action for enforcement, and the Colorado Attorney General has exclusive authority to enforce it.³
Companies operating in the AI industry or deploying AI systems may be seeking opportunities to leverage their ongoing compliance efforts in anticipation of the emergence of other similar state AI regulations. Therefore, it is worth recognizing that the Revised CO AI Act is not breaking entirely new ground; instead, some of its definitions, regulations and requirements can be found in other state-level AI governance laws.
One similar law can be found in the California Consumer Privacy Act (CCPA). In 2025, following a lengthy and closely watched rulemaking process, new regulations were enacted under the CCPA addressing ADMT, introducing new compliance obligations for businesses that use ADMT to make “significant decisions” about consumers (CA ADMT regulations).⁴
However, although the Revised CO AI Act and the CA ADMT regulations share a common goal of regulating automated decision-making, they diverge in several key ways. Notably, and as discussed above, the Revised CO AI Act seems to adopt a broader definition of ADMT, encompassing technology that makes, guides or assists in a decision, judgment or determination concerning an individual. In contrast, the CCPA limits ADMT to systems that actually replace or substantially replace human decision-making.⁵ Additionally, the Revised CO AI Act aims to regulate both developers and deployers, assigning distinct obligations to each, while the CCPA primarily regulates businesses that use ADMT.
The two regimes also differ in their approach to consumer rights. At first glance, the CCPA seems to provide a broader set of rights, including the right to opt out of certain ADMT uses, access meaningful information about ADMT and request human review of decisions made with ADMT.⁶ By contrast, the Revised CO AI Act seems to emphasize notice, explanation, correction and human review in cases of adverse decisions, and does not offer a comparable broad opt-out right. Nonetheless, the laws are similarly limited in reach due to the territorial constraints inherent in state-level regulations.
With regard to enforcement, the Revised CO AI Act adopts an ADMT-specific regime, including role-based liability allocation and a cure period, whereas the CA ADMT regulations operate within the existing CCPA enforcement framework. Important for companies seeking to comply with either law, both are scheduled to take effect on the same timeline, with enforcement beginning on January 1, 2027.
Organizations should continue to pay close attention to the development of the rules under the Revised CO AI Act, which are anticipated over the coming months leading up to the entry into force of the law in early 2027. In particular, transparency requirements for companies developing or deploying AI systems continue to be a growing regulatory trend. Proactive compliance efforts and preparation should be a priority as further regulatory guidance and rules continue to emerge.
Practice areas:
Industries:
Publication
Bloomberg is reporting that federal prosecutors with the US Department of Justice Antitrust Division have obtained court authorization to review privileged communications between a major private equity company and its lawyers.
United States | May 19, 2026
Publication
Colorado’s first artificial intelligence governance law has been the center of attention recently.
United States | May 19, 2026
Publication
This alert highlights recent developments in the case filed by X.AI seeking to enjoin enforcement of Colorado's Senate Bill 24-205, often referred to as the Colorado AI Act.
United States | May 12, 2026
Subscribe and stay up to date with the latest legal news, information and events . . .
Top
© Norton Rose Fulbright US LLP 2026
Norton Rose Fulbright © 2026. All Rights Reserved.
Norton Rose Fulbright US LLP is a limited liability partnership registered under the laws of Texas. Attorney Advertising.
Norton Rose Fulbright US LLP, Norton Rose Fulbright LLP and Norton Rose Fulbright Canada LLP are separate legal entities and all of them are members of Norton Rose Fulbright Verein, a Swiss verein. Norton Rose Fulbright Verein helps coordinate the activities of the members but does not itself provide legal services to clients.
Norton Rose Fulbright © 2026. All Rights Reserved.
Norton Rose Fulbright US LLP is a limited liability partnership registered under the laws of Texas. Attorney Advertising.
Norton Rose Fulbright US LLP, Norton Rose Fulbright LLP and Norton Rose Fulbright Canada LLP are separate legal entities and all of them are members of Norton Rose Fulbright Verein, a Swiss verein. Norton Rose Fulbright Verein helps coordinate the activities of the members but does not itself provide legal services to clients.

source